Exploit for CVE-2023-27524

kitploit · 2026-09-07

Description

Apache Superset insecure default configuration enables auth bypass leading to remote code execution.

Affected Apache Superset versions

Apache Superset≤ 2.0.1

All known vulnerabilities by product

Apache Superset

CVSS 9.8 for CVE-2023-27524

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:HIGH

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:LOW

EPSS Score

97.4%higher than 99.9% of all CVEs

Updated 2026-09-11

CVE Information

References

https://github.com/horizon3ai/CVE-2023-27524

Exploit Details

Modified:2026-09-07 13:20

Last Seen:2026-09-08 18:13

Reporter:KitPloit

Tags

Apache Supersetauth bypassinsecure default configremote code executionconfiguration flaw

Other exploits for CVE-2023-27524

2026-09-11 KitPloitKITPLOIT

2026-09-11 KitPloitKITPLOIT

sound4-directory-listing

2026-09-11 KitPloitKITPLOIT

Superset_auth_bypass_check

2026-09-11 KitPloitKITPLOIT

CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE

2026-09-11 KitPloitKITPLOIT

2026-09-11 KitPloitKITPLOIT

2026-09-11 KitPloitKITPLOIT

2026-09-10 KitPloitKITPLOIT

Exploit Code

MARKDOWN10 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-TARDC-CVE-2023-27524
# CVE-2023-27524

Apache Superset Auth Bypass (CVE-2023-27524)

## Reference

  * https://nvd.nist.gov/vuln/detail/CVE-2023-27524
  * https://github.com/horizon3ai/CVE-2023-27524
  * https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/